Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open | Date | Sat, 27 Apr 2024 18:44:25 +0800 |
| |
On Fri, 26 Apr 2024 05:00:21 -0700 > syzbot found the following issue on: > > HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53
--- x/fs/char_dev.c +++ y/fs/char_dev.c @@ -377,6 +377,9 @@ static int chrdev_open(struct inode *ino struct cdev *new = NULL; int ret = 0; + if (!igrab(inode)) + return -ENXIO; + spin_lock(&cdev_lock); p = inode->i_cdev; if (!p) { @@ -384,8 +387,10 @@ static int chrdev_open(struct inode *ino int idx; spin_unlock(&cdev_lock); kobj = kobj_lookup(cdev_map, inode->i_rdev, &idx); - if (!kobj) + if (!kobj) { + iput(inode); return -ENXIO; + } new = container_of(kobj, struct cdev, kobj); spin_lock(&cdev_lock); /* Check i_cdev again in case somebody beat us to it while @@ -401,8 +406,10 @@ static int chrdev_open(struct inode *ino ret = -ENXIO; spin_unlock(&cdev_lock); cdev_put(new); - if (ret) + if (ret) { + iput(inode); return ret; + } ret = -ENXIO; fops = fops_get(p->ops); @@ -416,10 +423,12 @@ static int chrdev_open(struct inode *ino goto out_cdev_put; } + iput(inode); return 0; out_cdev_put: cdev_put(p); + iput(inode); return ret; } --
| |